It has been one year since Russia invaded Ukraine, forcing millions to abandon their homes, shelling major cities, and escalating the ongoing conflict between Russia and NATO. Thus far in 2023, Russia resumed its offensive, including attacks on Soledar, both the U.S. and U.K. announced intentions to send weapons to Ukraine, and Putin suspended the U.S.-Russia nuclear treaty.
For Chainalysis, this one-year anniversary is a chance to reflect on the significant role cryptocurrency has played in the Russia-Ukraine War, in ways both good and bad. Below, we’ll share data on how cryptocurrency has impacted citizens in both countries, whether in the form of malicious activity like ransomware attacks and sanctions evasion, or more positive use cases like facilitation of donations to those in affected areas. Ultimately, our analysis reveals just how embedded cryptocurrency has become in the world economy–and in Eastern Europe in particular–and highlights its unique utility in cross-border payments, especially during tumultuous times like these.
Pro-Russia groups soliciting crypto donations
Approximately five months after the war began, we identified 54 volunteer groups committed to crowdfunding Russian military purchases, spreading disinformation, and creating pro-invasion propaganda. At the time, we found that those organizations had received roughly $2.2 million in donations, some of which came before the invasion. As of now at the one-year mark of the war, the number of pro-Russia organizations we’ve identified has grown to around 100, with nearly $5.4 million in donations received. However, those donations have waned over the course of the year.
The Chainalysis Reactor graph below depicts an example of one pro-Russia group’s on-chain activity. On the left, we see that donors sent Bitcoin to Task Force Rusich, a sanctioned Russian paramilitary organization operating in Ukraine, after which Rusich moved the funds to a high-risk exchange.
This funneling of cryptocurrency to exchanges is typical of other donation-soliciting pro-Russia groups, though most are sending funds to mainstream centralized exchanges as opposed to high-risk exchanges, as we see on the chart below.
87.3% of the funds received by pro-Russia groups has gone to mainstream exchanges, with 4.4% to high-risk exchanges. For comparison, cybercriminal administrators associated with ransomware gangs and other malicious activities active over the same time period have sent 30.3% of their funds to mainstream exchanges, with higher shares going to DeFi protocols and sanctioned exchanges.
Potential Russian sanctions evasion
The increased sanctions on Russian businesses and oligarchs following the invasion, combined with Russia’s long standing high cryptocurrency usage, had many wondering if wealthy Russians may turn to crypto to evade sanctions and move money out of the country. To investigate that question, we previously explored the liquidity of cryptocurrency markets by analyzing the circulating supply of cryptocurrency and mixer liquidity, among other data points. Our findings suggested that the cryptocurrency markets are almost certainly too illiquid to support mass Russian sanctions evasion, though that does not mean this activity isn’t occurring on a smaller scale.
One way to estimate smaller-scale potential sanctions evasion is to look at inflows to high-risk exchanges disproportionately catering to Russia-based users.
Overall, while we see a small spike around the date of the invasion in February 2022, the data doesn’t suggest that the war has spurred increased inflows — most of the larger spikes we see appear to be more correlated with general trends in the crypto markets overall.
Ransomware and “hacktivism”
In recent years, ransomware attacks have been on the rise due to factors such as new technology vulnerabilities due to the work-from-home culture. In our 2023 Crypto Crime Report, we identified at least $456.8 million in ransomware payments in 2022, the majority of which was taken by actors believed to be based in Russia.
Ransomware attacks have often been utilized by bad actors for political agendas, and we’ve seen plenty of examples during the Russia-Ukraine War. For instance, Conti, a prolific Russia-based ransomware group, obtained approximately $66 million from victims in 2022. Following the invasion, Conti announced its support for the Russian government, which led many victims to stop paying their ransoms given the increased legal risk, and also prompted an insider to leak documents exposing Conti’s inner workings.
Conti publicly claimed to cease operations soon after this, though as we discuss in our ransomware analysis, many actors associated with Conti have continued to carry out ransomware attacks under different strain names.
Similarly, since at least January 2022, pro-Russian “hacktivist” group KillNet has been targeting countries supporting Ukraine, even declaring “war” against 10 countries after a failed distributed denial-of-service (DDoS) attack. KillNet has previously targeted healthcare organizations and is currently focusing on donations made by NATO countries. KillNet uses its notoriety and social media platforms to solicit donations in cryptocurrency, including minting an NFT. Additionally, KillNet has used its platforms to advertise fundraisers specifically for purchasing supplies and military equipment for the Russian military.
Donations to Ukraine
Although cryptocurrencies have been used for malicious efforts during the war, they have also emboldened Ukraine in numerous positive ways. For instance, in March 2022, we determined that more than $56 million worth of cryptocurrencies had been donated to addresses provided by the Ukrainian government since the start of the war. As of February 2023, these donations have grown to a total of nearly $70 million. The below graph demonstrates that the majority of donations were made in BTC and ETH, two of the most popular cryptocurrencies.
There have been additional donations to charity organizations and donations in the form of NFTs, such as UkraineDAO’s auction of a Ukrainian flag NFT for $6.5 million. Although such donations pale in comparison to fiat donations, they demonstrate the philanthropy of cryptocurrency enthusiasts across the globe and Ukraine’s willingness to accept a wide variety of digital assets.
Increased adoption for economic relief
For emerging markets such as Ukraine, cryptocurrencies have the potential to act as a reliable store of value, reduce cross-border transaction costs, and boost financial independence. In fact, Ukraine ranked third on our 2022 Global Crypto Adoption Index for many of those reasons.
In addition to helping with war efforts, cryptocurrency donations are likely to encourage increased adoption and strengthen an economy that has otherwise been hampered by the war.
The above graph shows web traffic to centralized exchanges (CEXs) in Eastern Europe in 2022 to the present. Adoption by Ukraine surged over the course of the war. On the contrary, Russian adoption declined significantly.
Monitoring the situation
Despite the persistent donations to pro-Russia organizations, money laundering behaviors, and ransomware attacks, cryptocurrencies have provided myriad positive benefits for Ukraine, bolstering resilience during difficult times and encouraging worldwide support for those affected by Russia’s invasion.
We will continue to pay close attention to cryptocurrency transactions and other related efforts as it pertains to Russia’s war in Ukraine, and provide updated data when necessary. Sign up for our newsletter at the bottom of this page or follow us on Twitter to stay tuned.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.